### linux 3

#### Sun, 25 Jan 2026 16:00:41 India Standard Time

##### TABLE OF CONTENTS

- Vulnerabilities by Host
  - 172.17.100.236
- Compliance 'FAILED'
- Compliance 'SKIPPED'
- Compliance 'PASSED'
- Compliance 'INFO', 'WARNING', 'ERROR'
- Remediations
  - Suggested Remediations

###### Vulnerabilities by HostExpand All | Collapse All

172.17.100.236

2 | 1 | 8 | 2 | 1353
Critical | High | Medium | Low | Info

Scan Information

Start time: | Sun Jan 25 15:12:26 2026
End time: | Sun Jan 25 16:00:41 2026

Host Information

IP: | 172.17.100.236
OS: | VMware ESXi 8.0.2 build-23825572

Vulnerabilities

##

237304 - VMware ESXi 7.0 / 8.0 Multiple Vulnerabilities (VMSA-2025-0004)
-
Synopsis
The remote VMware ESXi host is affected by multiple vulnerabilities.
Description
The version of VMware ESXi installed on the remote host is 7.0 prior to 7.0 Update 3s, 8.0 Update 2 prior to 8.0 Update 2d, or 8.0 Update 3 prior to 8.0 Update 3d. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2025-0004 advisory:
- VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. (CVE-2025-22224)
- VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox. (CVE-2025-22225)
- VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process. (CVE-2025-22226)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?15790ced

Solution
Upgrade to VMware ESXi 7.0 Update 3s, 8.0 Update 2d, or 8.0 Update 3d or later.
Risk Factor
High
CVSS v3.0 Base Score
9.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
VPR Score
8.1
EPSS Score
0.5147
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
STIG Severity
I
References

CVE | CVE-2025-22224
CVE | CVE-2025-22225
CVE | CVE-2025-22226
XREF | VMSA:2025-0004
XREF | CISA-KNOWN-EXPLOITED:2025/03/25
XREF | IAVA:2025-A-0148-S

Plugin Information
Published: 2025/05/27, Modified: 2025/06/02
Plugin Output

## tcp/443/www

ESXi version : VMware ESXi 8.0.2 build-23825572
Installed build : 23825572
Fixed build : 8.0U2d 24585300
242168 - VMware ESXi 7.x < 7.0 Update 3w / 8.x < 8.0 Update 2e / 8.0 Update 3 < 8.0 Update 3f (VMSA-2025-0013)
-
Synopsis
VMware ESXi is affected by multiple vulnerabilities.
Description
The version of VMware ESXi installed on the remote host is 7.x prior to 7.0 Update 3w, 8.x prior to 8.0 Update 2e, or 8.0 Update 3 prior to 8.0 Update 3f. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2025-0013 advisory:
- VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. (CVE-2025-41236)
- VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. (CVE-2025-41237)
- VMware ESXi, Workstation, and Fusion contain a heap-overflow vulnerability in the PVSCSI (Paravirtualized SCSI) controller that leads to an out of-bounds write. (CVE-2025-41238)
- VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. (CVE-2025-41239)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?98207605

Solution
Upgrade to VMware ESXi 7.0 Update 3w, 8.0 Update 2e, or 8.0 Update 3f or later.
Risk Factor
High
CVSS v3.0 Base Score
9.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
VPR Score
8.1
EPSS Score
0.0002
CVSS v2.0 Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
STIG Severity
I
References

CVE | CVE-2025-41236
CVE | CVE-2025-41237
CVE | CVE-2025-41238
CVE | CVE-2025-41239
XREF | IAVA:2025-A-0539

Plugin Information
Published: 2025/07/16, Modified: 2025/07/25
Plugin Output

## tcp/443/www

ESXi version : 8.0.2
Installed build : 23825572
Fixed build : 8.0U2e 24789317

##

201194 - OpenSSH < 9.8 RCE
-
Synopsis
The SSH server running on the remote host is affected by a vulnerability.
Description
The version of OpenSSH installed on the remote host is prior to 9.8. It is, therefore, affected by a vulnerability as referenced in the release-9.8 advisory.
- This release contains fixes for two security problems, one critical and one minor. 1) Race condition in sshd(8) A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon. Exploitation on non-glibc systems is conceivable but has not been examined. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomisation (yes - this is a thing, no - we don't understand why) may potentially have an easier path to exploitation. OpenBSD is not vulnerable. We thank the Qualys Security Advisory Team for discovering, reporting and demonstrating exploitability of this problem, and for providing detailed feedback on additional mitigation measures. 2) Logic error in ssh(1) ObscureKeystrokeTiming In OpenSSH version 9.5 through 9.7 (inclusive), when connected to an OpenSSH server version 9.5 or later, a logic error in the ssh(1) ObscureKeystrokeTiming feature (on by default) rendered this feature ineffective - a passive observer could still detect which network packets contained real keystrokes when the countermeasure was active because both fake and real keystroke packets were being sent unconditionally. This bug was Daniel Hugenroth and Alastair Beresford of the University of Cambridge Computer Lab. Worse, the unconditional sending of both fake and real keystroke packets broke another long- standing timing attack mitigation. Since OpenSSH 2.9.9 sshd(8) has sent fake keystoke echo packets for traffic received on TTYs in echo-off mode, such as when entering a password into su(8) or sudo(8). This bug rendered these fake keystroke echoes ineffective and could allow a passive observer of a SSH session to once again detect when echo was off and obtain fairly limited timing information about keystrokes in this situation (20ms granularity by default). This additional implication of the bug was identified by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford and we thank them for their detailed analysis.
This bug does not affect connections when ObscureKeystrokeTiming was disabled or sessions where no TTY was requested. (openssh-9.8-1)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://www.openssh.com/txt/release-9.8

Solution
Upgrade to OpenSSH version 9.8 or later.
Risk Factor
High
CVSS v3.0 Base Score
8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS v3.0 Temporal Score
7.3 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
9.0
EPSS Score
0.5079
CVSS v2.0 Base Score
7.6 (CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS v2.0 Temporal Score
6.0 (CVSS2#E:POC/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2024-6387
CVE | CVE-2024-39894
XREF | IAVA:2024-A-0375-S

Plugin Information
Published: 2024/07/01, Modified: 2025/03/11
Plugin Output

## tcp/22/ssh

Version source : SSH-2.0-OpenSSH_9.0
Installed version : 9.0
Fixed version : 9.8p1 / 9.8
187201 - OpenSSH < 9.6 Multiple Vulnerabilities
-
Synopsis
The SSH server running on the remote host is affected by multiple vulnerabilities.
Description
The version of OpenSSH installed on the remote host is prior to 9.6. It is, therefore, affected by multiple vulnerabilities as referenced in the release-9.6 advisory.
- ssh(1), sshd(8): implement protocol extensions to thwart the so-called Terrapin attack discovered by Fabian Bumer, Marcus Brinkmann and Jrg Schwenk. This attack allows a MITM to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. A peer SSH client/server would not be able to detect that messages were deleted. While cryptographically novel, the security impact of this attack is fortunately very limited as it only allows deletion of consecutive messages, and deleting most messages at this stage of the protocol prevents user user authentication from proceeding and results in a stuck connection. The most serious identified impact is that it lets a MITM to delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.
There is no other discernable impact to session secrecy or session integrity. OpenSSH 9.6 addresses this protocol weakness through a new strict KEX protocol extension that will be automatically enabled when both the client and server support it. This extension makes two changes to the SSH transport protocol to improve the integrity of the initial key exchange. Firstly, it requires endpoints to terminate the connection if any unnecessary or unexpected message is received during key exchange (including messages that were previously legal but not strictly required like SSH2_MSG_DEBUG). This removes most malleability from the early protocol. Secondly, it resets the Message Authentication Code counter at the conclusion of each key exchange, preventing previously inserted messages from being able to make persistent changes to the sequence number across completion of a key exchange. Either of these changes should be sufficient to thwart the Terrapin Attack. More details of these changes are in the PROTOCOL file in the OpenSSH source distribition. (CVE-2023-48795)
- ssh-agent(1): when adding PKCS#11-hosted private keys while specifying destination constraints, if the PKCS#11 token returned multiple keys then only the first key had the constraints applied. Use of regular private keys, FIDO tokens and unconstrained keys are unaffected. (CVE-2023-51384)
- ssh(1): if an invalid user or hostname that contained shell metacharacters was passed to ssh(1), and a ProxyCommand, LocalCommand directive or match exec predicate referenced the user or hostname via %u, %h or similar expansion token, then an attacker who could supply arbitrary user/hostnames to ssh(1) could potentially perform command injection depending on what quoting was present in the user-supplied ssh_config(5) directive. This situation could arise in the case of git submodules, where a repository could contain a submodule with shell characters in its user/hostname. Git does not ban shell metacharacters in user or host names when checking out repositories from untrusted sources. Although we believe it is the user's responsibility to ensure validity of arguments passed to ssh(1), especially across a security boundary such as the git example above, OpenSSH 9.6 now bans most shell metacharacters from user and hostnames supplied via the command-line. This countermeasure is not guaranteed to be effective in all situations, as it is infeasible for ssh(1) to universally filter shell metacharacters potentially relevant to user-supplied commands. User/hostnames provided via ssh_config(5) are not subject to these restrictions, allowing configurations that use strange names to continue to be used, under the assumption that the user knows what they are doing in their own configuration files. (CVE-2023-51385)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

https://www.openssh.com/txt/release-9.6

Solution
Upgrade to OpenSSH version 9.6 or later.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:P/RL:O/RC:C)
VPR Score
6.7
EPSS Score
0.5777
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v2.0 Temporal Score
5.0 (CVSS2#E:POC/RL:OF/RC:C)
STIG Severity
I
References

CVE | CVE-2023-48795
CVE | CVE-2023-51384
CVE | CVE-2023-51385
XREF | IAVA:2023-A-0701-S

Plugin Information
Published: 2023/12/22, Modified: 2025/02/28
Plugin Output

## tcp/22/ssh

Version source : SSH-2.0-OpenSSH_9.0
Installed version : 9.0
Fixed version : 9.6p1 / 9.6

##

51192 - SSL Certificate Cannot Be Trusted
-
Synopsis
The SSL certificate for this service cannot be trusted.
Description
The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :
- First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
- Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
- Third, the certificate chain may contain a signature that either didn't match the certificate's information or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.
See Also

https://www.itu.int/rec/T-REC-X.509/en
https://en.wikipedia.org/wiki/X.509

Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2010/12/15, Modified: 2025/06/16
Plugin Output

## tcp/443/www

The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : C=US/ST=California/L=Palo Alto/O=VMware/OU=VMware Engineering/CN=172.17.100.236/E=vmca@vmware.com
|-Issuer : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering

##

51192 - SSL Certificate Cannot Be Trusted
-
Synopsis
The SSL certificate for this service cannot be trusted.
Description
The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :
- First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
- Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
- Third, the certificate chain may contain a signature that either didn't match the certificate's information or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.
See Also

https://www.itu.int/rec/T-REC-X.509/en
https://en.wikipedia.org/wiki/X.509

Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2010/12/15, Modified: 2025/06/16
Plugin Output

## tcp/8182

The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Issuer : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering

##

51192 - SSL Certificate Cannot Be Trusted
-
Synopsis
The SSL certificate for this service cannot be trusted.
Description
The server's X.509 certificate cannot be trusted. This situation can occur in three different ways, in which the chain of trust can be broken, as stated below :
- First, the top of the certificate chain sent by the server might not be descended from a known public certificate authority. This can occur either when the top of the chain is an unrecognized, self-signed certificate, or when intermediate certificates are missing that would connect the top of the certificate chain to a known public certificate authority.
- Second, the certificate chain may contain a certificate that is not valid at the time of the scan. This can occur either when the scan occurs before one of the certificate's 'notBefore' dates, or after one of the certificate's 'notAfter' dates.
- Third, the certificate chain may contain a signature that either didn't match the certificate's information or could not be verified. Bad signatures can be fixed by getting the certificate with the bad signature to be re-signed by its issuer. Signatures that could not be verified are the result of the certificate's issuer using a signing algorithm that Nessus either does not support or does not recognize.
If the remote host is a public host in production, any break in the chain makes it more difficult for users to verify the authenticity and identity of the web server. This could make it easier to carry out man-in-the-middle attacks against the remote host.
See Also

https://www.itu.int/rec/T-REC-X.509/en
https://en.wikipedia.org/wiki/X.509

Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2010/12/15, Modified: 2025/06/16
Plugin Output

## tcp/9080/www

The following certificate was at the top of the certificate
chain sent by the remote host, but it is signed by an unknown
certificate authority :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Issuer : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering

##

57582 - SSL Self-Signed Certificate
-
Synopsis
The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
Description
The X.509 certificate chain for this service is not signed by a recognized certificate authority. If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host.
Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.
Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2012/01/17, Modified: 2022/06/14
Plugin Output

## tcp/8182

The following certificate was found at the top of the certificate
chain sent by the remote host, but is self-signed and was not
found in the list of known certificate authorities :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering

##

57582 - SSL Self-Signed Certificate
-
Synopsis
The SSL certificate chain for this service ends in an unrecognized self-signed certificate.
Description
The X.509 certificate chain for this service is not signed by a recognized certificate authority. If the remote host is a public host in production, this nullifies the use of SSL as anyone could establish a man-in-the-middle attack against the remote host.
Note that this plugin does not check for certificate chains that end in a certificate that is not self-signed, but is signed by an unrecognized certificate authority.
Solution
Purchase or generate a proper SSL certificate for this service.
Risk Factor
Medium
CVSS v3.0 Base Score
6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVSS v2.0 Base Score
6.4 (CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)
Plugin Information
Published: 2012/01/17, Modified: 2022/06/14
Plugin Output

## tcp/9080/www

The following certificate was found at the top of the certificate
chain sent by the remote host, but is self-signed and was not
found in the list of known certificate authorities :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering

##

237246 - VMware ESXi 7.0 / 8.0 Multiple Vulenerabilities (VMSA-2025-0010)
-
Synopsis
The VMware ESXi is affected by multiple vulnerabilities.
Description
The version of VMware ESXi installed on the remote host is 7.0.x prior to 7.0 Update 3v or 8.0.x prior to 8.0 Update 3e. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2025-0010 advisory.
- ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. (CVE-2025-41226)
- Workstation, Fusion and ESXi contain a denial-of-service vulnerability due to certain guest options. (CVE-2025-41227)
- VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. (CVE-2025-41228)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?c8ce45e5

Solution
Upgrade to ESXi 7.0 Update 3v, 8.0 Update 3e or later.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
VPR Score
6.7
EPSS Score
0.0003
CVSS v2.0 Base Score
5.5 (CVSS2#AV:A/AC:L/Au:S/C:N/I:N/A:C)
STIG Severity
I
References

CVE | CVE-2025-41226
CVE | CVE-2025-41227
CVE | CVE-2025-41228
XREF | IAVA:2025-A-0367-S

Plugin Information
Published: 2025/05/26, Modified: 2025/08/12
Plugin Output

## tcp/443/www

ESXi version : 8.0
Installed build : 23825572
Fixed build : 8.0U3 24659227
201125 - VMware ESXi 7.0 / 8.0 Out-of-Bounds read (CVE-2024-37086)
-
Synopsis
The remote VMware ESXi host is affected by a out-of-bounds read vulnerability.
Description
The version of VMware ESXi installed on the remote host is prior to 7.0 Update 3q or 8.0 prior to 8.0 Update 3. It is, therefore, affected by an out-of-bounds read vulnerability as referenced in the VMSA-2024-0013 advisory:
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
See Also

http://www.nessus.org/u?04fbf245

Solution
Upgrade to VMware ESXi 7.0 Update 3q, 8.0 Update 3 or later.
Risk Factor
Medium
CVSS v3.0 Base Score
6.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
CVSS v3.0 Temporal Score
5.9 (CVSS:3.0/E:U/RL:O/RC:C)
VPR Score
4.2
EPSS Score
0.0005
CVSS v2.0 Base Score
5.6 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:C)
CVSS v2.0 Temporal Score
4.1 (CVSS2#E:U/RL:OF/RC:C)
STIG Severity
II
References

CVE | CVE-2024-37086
XREF | VMSA:2024-0013
XREF | IAVA:2024-A-0373

Plugin Information
Published: 2024/06/28, Modified: 2025/03/06
Plugin Output

## tcp/443/www

ESXi version : VMware ESXi 8.0.2 build-23825572
Installed build : 23825572
Fixed build : 8.0U3 24022510

##

234554 - OpenSSH < 10.0 DisableForwarding
-
Synopsis
The SSH server running on the remote host is affected by a vulnerability.
Description
The version of OpenSSH installed on the remote host is prior to 10.0. It is, therefore, affected by a vulnerability. In sshd in OpenSSH the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://www.openssh.com/txt/release-10.0

Solution
Upgrade to OpenSSH version 10.0 or later.
Risk Factor
Low
CVSS v3.0 Base Score
3.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
VPR Score
2.4
EPSS Score
0.0001
CVSS v2.0 Base Score
2.1 (CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N)
STIG Severity
I
References

CVE | CVE-2025-32728
XREF | IAVA:2025-A-0258-S

Plugin Information
Published: 2025/04/17, Modified: 2025/10/29
Plugin Output

## tcp/22/ssh

Version source : SSH-2.0-OpenSSH_9.0
Installed version : 9.0
Fixed version : 10.0
269984 - OpenSSH < 10.1 / 10.1p1 Multiple Vulnerabilities
-
Synopsis
The SSH server running on the remote host is affected by multiple vulnerabilities.
Description
The version of OpenSSH installed on the remote host is prior to 10.1. It is, therefore, affected by multiple vulnerabilities:
- ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.) (CVE-2025-61984)
- ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (CVE-2025-61985)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
See Also

https://www.openssh.com/releasenotes.html#10.1p1

Solution
Upgrade to OpenSSH version 10.1/10.1p1 or later.
Risk Factor
Low
CVSS v3.0 Base Score
3.6 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
VPR Score
4.0
EPSS Score
0.0001
CVSS v2.0 Base Score
2.4 (CVSS2#AV:L/AC:H/Au:S/C:P/I:P/A:N)
STIG Severity
II
References

CVE | CVE-2025-61984
CVE | CVE-2025-61985
XREF | IAVA:2025-A-0806
XREF | IAVA:2025-A-0729-S

Plugin Information
Published: 2025/10/10, Modified: 2025/11/18
Plugin Output

## tcp/22/ssh

Version source : SSH-2.0-OpenSSH_9.0
Installed version : 9.0
Fixed version : 10.1 / 10.1.p1

##

45590 - Common Platform Enumeration (CPE)
-
Synopsis
It was possible to enumerate CPE names that matched on the remote system.
Description
By using information obtained from a Nessus scan, this plugin reports CPE (Common Platform Enumeration) matches for various hardware and software products found on a host.
Note that if an official CPE is not available for the product, this plugin computes the best possible CPE based on the information available from the scan.
See Also

http://cpe.mitre.org/
https://nvd.nist.gov/products/cpe

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2010/04/21, Modified: 2025/09/29
Plugin Output

## tcp/0

The remote operating system matched the following CPE's :
cpe:/o:vmware:esxi:8.0 -> VMware ESXi
cpe:/o:vmware:esxi:8.0.2 -> VMware ESXi
Following application CPE's matched on the remote system :
cpe:/a:openbsd:openssh:9.0 -> OpenBSD OpenSSH
cpe:/a:smartbedded:meteobridge_firmware
cpe:/a:vmware:open_vm_tools:12.3.5 -> VMware Open VM Tools
cpe:/a:vmware:vmware_server
84239 - Debugging Log Report
-
Synopsis
This plugin gathers the logs written by other plugins and reports them.
Description
Logs generated by other plugins are reported by this plugin. Plugin debugging must be enabled in the policy in order for this plugin to run.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2015/06/17, Modified: 2025/07/14
Plugin Output

## tcp/0

Plugin debug log(s) have been attached.
54615 - Device Type
-
Synopsis
It is possible to guess the remote device type.
Description
Based on the remote operating system, it is possible to determine what the remote system type is (eg: a printer, router, general-purpose computer, etc).
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/05/23, Modified: 2025/03/12
Plugin Output

## tcp/0

Remote device type : hypervisor
Confidence level : 99
168980 - Enumerate the PATH Variables
-
Synopsis
Enumerates the PATH variable of the current scan user.
Description
Enumerates the PATH variables of the current scan user.
Solution
Ensure that directories listed here are in line with corporate policy.
Risk Factor
None
Plugin Information
Published: 2022/12/21, Modified: 2025/12/18
Plugin Output

## tcp/0

Nessus has enumerated the path of the current scan user :
/bin
/sbin
117530 - Errors in nessusd.dump
-
Synopsis
This plugin parses information from the nessusd.dump log file and reports on errors.
Description
This plugin parses information from the nessusd.dump log file and reports on errors.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2018/09/17, Modified: 2024/11/04
Plugin Output

## tcp/0

The nessusd.dump log file contained errors from the following plugins:
- upnp_search.nasl reported 3 errors
- onvif_detect.nbin reported 5 errors
- amanda_detect.nasl reported 1 error
- react_CVE-2025-55182.nbin reported 2 errors
- quic_detect.nasl reported 2 errors
- log4j_log4shell_www.nbin reported 1 error

##

84502 - HSTS Missing From HTTPS Server
-
Synopsis
The remote web server is not enforcing HSTS.
Description
The remote HTTPS server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections.
See Also

https://tools.ietf.org/html/rfc6797

Solution
Configure the remote web server to use HSTS.
Risk Factor
None
Plugin Information
Published: 2015/07/02, Modified: 2024/08/09
Plugin Output

## tcp/9080/www

HTTP/1.1 200 OK
Server:
X-Frame-Options: SAMEORIGIN
Content-Type: text/xml
Content-Length: 0
Connection: close
The remote HTTPS server does not send the HTTP
"Strict-Transport-Security" header.

##

85805 - HTTP/2 Cleartext Detection
-
Synopsis
An HTTP/2 server is listening on the remote host.
Description
The remote host is running an HTTP server that supports HTTP/2 running over cleartext TCP (h2c).
See Also

https://http2.github.io/
https://tools.ietf.org/html/rfc7540
https://github.com/http2/http2-spec

Solution
Limit incoming traffic to this port if desired.
Risk Factor
None
Plugin Information
Published: 2015/09/04, Modified: 2022/04/11
Plugin Output

## tcp/80/www

The server supports direct HTTP/2 connections
without encryption.
24260 - HyperText Transfer Protocol (HTTP) Information
-
Synopsis
Some information about the remote HTTP configuration can be extracted.
Description
This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive is enabled, etc...
This test is informational only and does not denote any security problem.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/01/30, Modified: 2024/02/26
Plugin Output

## tcp/80/www

Response Code : HTTP/1.1 301 Moved Permanently
Protocol version : HTTP/1.1
HTTP/2 TLS Support: No
HTTP/2 Cleartext Support: Yes
SSL : no
Keep-Alive : no
Options allowed : (Not implemented)
Headers :
location: https://172.17.100.236:443/
date: Sun, 25 Jan 2026 10:06:30 GMT
content-length: 0
Response Body :

##

24260 - HyperText Transfer Protocol (HTTP) Information
-
Synopsis
Some information about the remote HTTP configuration can be extracted.
Description
This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive is enabled, etc...
This test is informational only and does not denote any security problem.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/01/30, Modified: 2024/02/26
Plugin Output

## tcp/443/www

Response Code : HTTP/1.1 200 OK
Protocol version : HTTP/1.1
HTTP/2 TLS Support: Yes
HTTP/2 Cleartext Support: Yes
SSL : yes
Keep-Alive : no
Options allowed : (Not implemented)
Headers :
date: Sun, 25 Jan 2026 10:06:29 GMT
content-security-policy: upgrade-insecure-requests
content-type: text/html
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1
content-length: 258
x-envoy-upstream-service-time: 0
Response Body :
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf8">
<meta http-equiv="refresh" content="0;URL='/ui'"/>
</head>
</html>

##

24260 - HyperText Transfer Protocol (HTTP) Information
-
Synopsis
Some information about the remote HTTP configuration can be extracted.
Description
This test gives some information about the remote HTTP protocol - the version used, whether HTTP Keep-Alive is enabled, etc...
This test is informational only and does not denote any security problem.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/01/30, Modified: 2024/02/26
Plugin Output

## tcp/9080/www

Response Code : HTTP/1.1 200 OK
Protocol version : HTTP/1.1
HTTP/2 TLS Support: No
HTTP/2 Cleartext Support: No
SSL : yes
Keep-Alive : no
Options allowed : (Not implemented)
Headers :
Server:
X-Frame-Options: SAMEORIGIN
Content-Type: text/xml
Content-Length: 0
Connection: close
Response Body :

##

95928 - Linux User List Enumeration
-
Synopsis
Nessus was able to enumerate local users and groups on the remote Linux host.
Description
Using the supplied credentials, Nessus was able to enumerate the local users and groups on the remote Linux host.
Solution
None
Risk Factor
None
Plugin Information
Published: 2016/12/19, Modified: 2025/03/26
Plugin Output

## tcp/0

User : root
Home folder : /
Start script : /bin/sh
Groups : root
User : dcui
Home folder : /
Start script : /bin/sh
Groups : users
User : vpxuser
Home folder : /
Start script : /bin/sh
Groups : users

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/22/ssh

Port 22/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/80/www

Port 80/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/443/www

Port 443/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/902/vmware_auth

Port 902/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/8000

Port 8000/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/8182

Port 8182/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/8300

Port 8300/tcp was found to be open

##

11219 - Nessus SYN scanner
-
Synopsis
It is possible to determine which TCP ports are open.
Description
This plugin is a SYN 'half-open' port scanner. It shall be reasonably quick even against a firewalled target.
Note that SYN scans are less intrusive than TCP (full connect) scans against broken services, but they might cause problems for less robust firewalls and also leave unclosed connections on the remote target, if the network is loaded.
Solution
Protect your target with an IP filter.
Risk Factor
None
Plugin Information
Published: 2009/02/04, Modified: 2025/07/14
Plugin Output

## tcp/9080/www

Port 9080/tcp was found to be open

##

19506 - Nessus Scan Information
-
Synopsis
This plugin displays information about the Nessus scan.
Description
This plugin displays, for each tested host, information about the scan itself :
- The version of the plugin set.
- The type of scanner (Nessus or Nessus Home).
- The version of the Nessus Engine.
- The port scanner(s) used.
- The port range scanned.
- The ping round trip time
- Whether credentialed or third-party patch management checks are possible.
- Whether the display of superseded patches is enabled
- The date of the scan.
- The duration of the scan.
- The number of hosts scanned in parallel.
- The number of checks done in parallel.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2005/08/26, Modified: 2025/10/29
Plugin Output

## tcp/0

Information about this scan :
Nessus version : 10.11.1
Nessus build : 20021
Plugin feed version : 202601041845
Scanner edition used : Nessus
Scanner OS : WINDOWS
Scanner distribution : win-x86-64
Scan type : Normal
Scan name : linux 3
Scan policy used : linux
Scanner IP : 172.17.100.38
Port scanner(s) : nessus_syn_scanner
Port range : 1-65535
Ping RTT : Unavailable
Thorough tests : no
Experimental tests : no
Scan for Unpatched Vulnerabilities : yes
Plugin debugging enabled : yes (at debugging level 4)
Paranoia level : 0
Report verbosity : 2
Safe checks : yes
Optimize the test : yes
Credentialed checks : yes, as 'root' via ssh
Attempt Least Privilege : no
Patch management checks : None
Display superseded patches : yes (supersedence plugin did not launch)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 1
Max checks : 1
Recv timeout : 5
Backports : None
Allow post-scan editing : Yes
Nessus Plugin Signature Checking : Enabled
Audit File Signature Checking : Disabled
Scan Start Date : 2026/1/25 15:13 India Standard Time (UTC +05:30)
Scan duration : 2824 sec
Scan for malware : no
58651 - Netstat Active Connections
-
Synopsis
Active connections are enumerated via the 'netstat' command.
Description
This plugin runs 'netstat' on the remote machine to enumerate all active 'ESTABLISHED' or 'LISTENING' tcp/udp connections.
Note: The output for this plugin can be very long, and is not shown by default. To display it, enable verbose reporting in scan settings.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2012/04/10, Modified: 2021/06/29
Plugin Output

## tcp/0

Netstat output :
-sh: netstat: not found
209654 - OS Fingerprints Detected
-
Synopsis
Multiple OS fingerprints were detected.
Description
Using a combination of remote probes (TCP/IP, SMB, HTTP, NTP, SNMP, etc), it was possible to gather one or more fingerprints from the remote system. While the highest-confidence result was reported in plugin 11936, “OS Identification”, the complete set of fingerprints detected are reported here.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/02/26, Modified: 2025/03/03
Plugin Output

## tcp/0

Following OS Fingerprints were found
Remote operating system : VMware ESXi
Confidence level : 56
Method : MLSinFP
Type : unknown
Fingerprint : unknown
Remote operating system : VMware ESXi 8.0.2 build-23825572
Confidence level : 98
Method : Misc
Type : hypervisor
Fingerprint : unknown
Remote operating system : VMware ESXi 8.0.2 build-23825572
Confidence level : 99
Method : uname
Type : hypervisor
Fingerprint : uname:VMkernel HOST05-236.lkpvm.com 8.0.2 #1 SMP Release build-23825572 May 8 2024 02:35:14 x86_64 x86_64 x86_64 ESXi
Following fingerprints could not be used to determine OS :
SSH:!:SSH-2.0-OpenSSH_9.0
HTTP:!:Server:
SinFP:!:
P1:B11113:F0x12:W65535:O0204ffff:M1460:
P2:B11113:F0x12:W65535:O0204ffff010303090402080affffffff44454144:M1460:
P3:B00000:F0x00:W0:O0:M0
P4:191601_7_p=443
SSLcert:!:i/CN:CAi/O:vcsa.lkpvm.comi/OU:VMware Engineerings/CN:172.17.100.236s/O:VMwares/OU:VMware Engineering
5841afacb40024773496bede5c51e0f16a6efdb0
i/CN:CAi/O:vcsa.lkpvm.comi/OU:VMware Engineerings/CN:172.17.100.236s/O:VMwares/OU:VMware Engineering
5841afacb40024773496bede5c51e0f16a6efdb0
11936 - OS Identification
-
Synopsis
It is possible to guess the remote operating system.
Description
Using a combination of remote probes (e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc.), it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2003/12/09, Modified: 2025/06/03
Plugin Output

## tcp/0

Remote operating system : VMware ESXi 8.0.2 build-23825572
Confidence level : 99
Method : uname
Not all fingerprints could give a match. If you think that these
signatures would help us improve OS fingerprinting, please submit
them by visiting https://www.tenable.com/research/submitsignatures.
SSH:!:SSH-2.0-OpenSSH_9.0
uname:VMkernel HOST05-236.lkpvm.com 8.0.2 #1 SMP Release build-23825572 May 8 2024 02:35:14 x86_64 x86_64 x86_64 ESXi
HTTP:!:Server:
SinFP:!:
P1:B11113:F0x12:W65535:O0204ffff:M1460:
P2:B11113:F0x12:W65535:O0204ffff010303090402080affffffff44454144:M1460:
P3:B00000:F0x00:W0:O0:M0
P4:191601_7_p=443
SSLcert:!:i/CN:CAi/O:vcsa.lkpvm.comi/OU:VMware Engineerings/CN:172.17.100.236s/O:VMwares/OU:VMware Engineering
5841afacb40024773496bede5c51e0f16a6efdb0
i/CN:CAi/O:vcsa.lkpvm.comi/OU:VMware Engineerings/CN:172.17.100.236s/O:VMwares/OU:VMware Engineering
5841afacb40024773496bede5c51e0f16a6efdb0
The remote host is running VMware ESXi 8.0.2 build-23825572
97993 - OS Identification and Installed Software Enumeration over SSH v2 (Using New SSH Library)
-
Synopsis
Information about the remote host can be disclosed via an authenticated session.
Description
Nessus was able to login to the remote host using SSH or local commands and extract the list of installed packages.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2017/05/30, Modified: 2025/02/11
Plugin Output

## tcp/0

It was possible to log into the remote host via SSH using 'keyboard-interactive' authentication.
Local checks have been enabled for this VMware ESXi host.
OS Security Patch Assessment is available for VMware ESXi, version 8.0.
Runtime : 4.245218 seconds
117887 - OS Security Patch Assessment Available
-
Synopsis
Nessus was able to log in to the remote host using the provided credentials and enumerate OS security patch levels.
Description
Nessus was able to determine OS security patch levels by logging into the remote host and running commands to determine the version of the operating system and its components. The remote host was identified as an operating system or device that Nessus supports for patch and update assessment. The necessary information was obtained to perform these checks.
Solution
n/a
Risk Factor
None
References

XREF | IAVB:0001-B-0516

Plugin Information
Published: 2018/10/02, Modified: 2021/07/12
Plugin Output

## tcp/0

OS Security Patch Assessment is available.
Account : root
Protocol : SSH

##

181418 - OpenSSH Detection
-
Synopsis
An OpenSSH-based SSH server was detected on the remote host.
Description
An OpenSSH-based SSH server was detected on the remote host.
See Also

https://www.openssh.com/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/09/14, Modified: 2025/12/15
Plugin Output

## tcp/22/ssh

Service : ssh
Version : 9.0
Banner : SSH-2.0-OpenSSH_9.0

##

66334 - Patch Report
-
Synopsis
The remote host is missing several patches.
Description
The remote host is missing one or more security patches. This plugin lists the newest version of each patch to install to make sure the remote host is up-to-date.
Note: Because the 'Show missing patches that have been superseded' setting in your scan policy depends on this plugin, it will always run and cannot be disabled.
Solution
Install the patches listed below.
Risk Factor
None
Plugin Information
Published: 2013/07/08, Modified: 2025/12/15
Plugin Output

## tcp/0

. You need to take the following action :
[ OpenSSH < 10.1 / 10.1p1 Multiple Vulnerabilities (269984) ]
+ Action to take : Upgrade to OpenSSH version 10.1/10.1p1 or later.
+ Impact : Taking this action will resolve the following 6 different vulnerabilities :
CVE-2025-32728, CVE-2024-6387, CVE-2024-39894, CVE-2023-51385, CVE-2023-51384
CVE-2023-48795

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

The target SSH server offers no post-quantum ciphers.

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/443/www

The target TLS server offers no post-quantum ciphers.

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/8182

The target TLS server offers no post-quantum ciphers.

##

277650 - Remote Services Not Using Post-Quantum Ciphers
-
Synopsis
Reports remote services that do not offer post-quantum ciphers.
Description
This plugin reports network services that do not offer post-quantum ciphers. Tenable makes no attempt to determine whether the remote service would be vulnerable to a post-quantum attack.
However, cryptography that depends on the classic difficulty of solving the discrete logarithm problem or on the classic difficulty of large prime factorization is broken by Shor's algorithm. Examples of this are RSA asymmetric encryption and Diffie-Hellman key exchange.
See Also

http://www.nessus.org/u?7a390f87
http://www.nessus.org/u?ad7d6b3b
http://www.nessus.org/u?1c0c61e0
http://www.nessus.org/u?5eec4b28

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/08
Plugin Output

## tcp/9080/www

The target TLS server offers no post-quantum ciphers.

##

70657 - SSH Algorithms and Languages Supported
-
Synopsis
An SSH server is listening on this port.
Description
This script detects which algorithms and languages are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/28, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

Nessus negotiated the following encryption algorithm(s) with the server :
Client to Server: aes256-ctr
Server to Client: aes256-ctr
The server supports the following options for compression_algorithms_server_to_client :
none
The server supports the following options for mac_algorithms_client_to_server :
hmac-sha2-256
hmac-sha2-512
The server supports the following options for server_host_key_algorithms :
ecdsa-sha2-nistp256
rsa-sha2-256
rsa-sha2-512
The server supports the following options for encryption_algorithms_client_to_server :
aes128-ctr
aes128-gcm@openssh.com
aes192-ctr
aes256-ctr
aes256-gcm@openssh.com
The server supports the following options for mac_algorithms_server_to_client :
hmac-sha2-256
hmac-sha2-512
The server supports the following options for kex_algorithms :
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
The server supports the following options for compression_algorithms_client_to_server :
none
The server supports the following options for encryption_algorithms_server_to_client :
aes128-ctr
aes128-gcm@openssh.com
aes192-ctr
aes256-ctr
aes256-gcm@openssh.com

##

100158 - SSH Combined Host Command Logging (Plugin Debugging)
-
Synopsis
If plugin debugging is enabled, this plugin writes the SSH commands run on the host to a combined log file in a machine readable format.
Description
If plugin debugging is enabled, this plugin writes the SSH commands run on the host to a combined log file in a machine readable format.
This log file resides on the scanner host itself.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2017/05/12, Modified: 2022/11/21
Plugin Output

## tcp/0

Combined log file location :
C:\ProgramData\Tenable\Nessus\nessus\tmp\ssh_commands-292ea91b-05fb-459e-8558-2e6a57c93b7f.log
168017 - SSH Per-Host Command Logging
-
Synopsis
If the 'Always report SSH commands' advanced preference is selected in the scan policy, this plugin will report all commands run over SSH on the host in a machine readable format.
Description
If the 'Always report SSH commands' advanced preference is selected in the scan policy, this plugin will report all commands run over SSH on the host in a machine readable format.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2022/11/21, Modified: 2022/11/21
Plugin Output

## tcp/0

The SSH commands run on this host have been attached:

##

10881 - SSH Protocol Versions Supported
-
Synopsis
A SSH server is running on the remote host.
Description
This plugin determines the versions of the SSH protocol supported by the remote SSH daemon.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2002/03/06, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

The remote SSH daemon supports the following versions of the
SSH protocol :
- 1.99
- 2.0
90707 - SSH SCP Protocol Detection
-
Synopsis
The remote host supports the SCP protocol over SSH.
Description
The remote host supports the Secure Copy (SCP) protocol over SSH.
See Also

https://en.wikipedia.org/wiki/Secure_copy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2016/04/26, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

10267 - SSH Server Type and Version Information
-
Synopsis
An SSH server is listening on this port.
Description
It is possible to obtain information about the remote SSH server by sending an empty authentication request.
Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0933

Plugin Information
Published: 1999/10/12, Modified: 2024/07/24
Plugin Output

## tcp/22/ssh

SSH version : SSH-2.0-OpenSSH_9.0
SSH supported authentication : publickey,keyboard-interactive

##

56984 - SSL / TLS Versions Supported
-
Synopsis
The remote service encrypts communications.
Description
This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/01, Modified: 2025/06/16
Plugin Output

## tcp/443/www

This port supports TLSv1.2.

##

56984 - SSL / TLS Versions Supported
-
Synopsis
The remote service encrypts communications.
Description
This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/01, Modified: 2025/06/16
Plugin Output

## tcp/8182

This port supports TLSv1.3/TLSv1.2.

##

56984 - SSL / TLS Versions Supported
-
Synopsis
The remote service encrypts communications.
Description
This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/01, Modified: 2025/06/16
Plugin Output

## tcp/9080/www

This port supports TLSv1.3/TLSv1.2.

##

10863 - SSL Certificate Information
-
Synopsis
This plugin displays the SSL certificate.
Description
This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2008/05/19, Modified: 2021/02/03
Plugin Output

## tcp/443/www

Subject Name:
Country: US
State/Province: California
Locality: Palo Alto
Organization: VMware
Organization Unit: VMware Engineering
Common Name: 172.17.100.236
Email Address: vmca@vmware.com
Issuer Name:
Common Name: CA
Domain Component: vsphere
Domain Component: local
Country: US
State/Province: California
Organization: vcsa.lkpvm.com
Organization Unit: VMware Engineering
Serial Number: 00 E3 FD D3 28 5A A7 24 61
Version: 3
Signature Algorithm: SHA-256 With RSA Encryption
Not Valid Before: Jan 26 02:46:56 2025 GMT
Not Valid After: Jan 26 02:46:56 2030 GMT
Public Key Info:
Algorithm: RSA Encryption
Key Length: 2048 bits
Public Key: 00 BD C6 85 E7 1F E1 52 B4 47 6C D0 3E 40 A4 B9 8C 88 2B 23
15 94 53 30 25 3A 29 71 E3 2A 7F 3F FB 42 5E 69 B0 0B DD D9
1C AC B5 9A 00 24 01 AA A6 81 CA CF 49 16 6E D4 76 A5 E9 84
86 F6 A1 3A 38 93 73 27 9D 38 80 7B 40 A8 60 0D DC 63 4D 50
8C DB 88 92 BD 87 3F 26 D2 B7 FE C6 A8 C1 4D 35 2B CE BB 31
BA 92 F9 DF 64 FC F0 F0 8D 96 9E 2D 11 5E B9 A6 94 61 4B 35
B1 4F A6 A1 80 8C D9 13 A8 F6 5E 9F BE 58 31 E2 69 83 05 17
F5 5F F0 EA 85 AE 35 89 11 4F 24 4F DD FA 36 05 96 49 13 47
CF 2F 34 E1 A2 F7 4B 4E AC 36 CE 96 7B F2 7E 66 27 E1 97 B6
81 8F 69 DB D8 40 93 DD 7E E7 B5 E7 9A 7D DE BD 9B 4F A3 9B
D3 B9 D6 DC A9 4E FA 87 F6 58 C6 26 35 67 62 64 F9 84 08 B7
F9 77 55 48 6C 34 74 25 B2 B5 62 D1 92 E7 A9 8B 9E 82 0E BA
7C DE 3E 57 EF 0D F2 F3 0B BA 74 8E 78 87 14 1C 83
Exponent: 01 00 01
Signature Length: 384 bytes / 3072 bits
Signature: 00 D4 00 40 39 B0 77 EA DC 79 7E EF F4 71 55 9A 9B 7E 99 30
5B 2B 16 03 47 B2 CB 1B C4 61 9B 73 C2 76 35 F8 D9 C9 61 B4
D3 9C 8B 06 48 D7 08 10 DE 75 45 3B 2F C1 B3 BA 00 0A 5B 41
4D 26 C0 47 99 F9 56 B1 56 E3 EE FB E6 14 3C B3 FD 7B A3 D4
7C 5F 8C DF F4 B7 0F C9 C5 C1 A1 70 A1 F9 6E 59 63 71 1E C6
CC 18 E5 06 C8 02 FA B9 70 F4 BB 5B 4D BB 6A C4 F3 AD 1D F5
42 97 85 0A BB F4 52 D3 99 7E 66 6D 4B 4D 50 4B 98 7D A7 19
71 AA E9 E0 89 F6 2B 7A A2 94 70 E3 A4 1A CE EA 8D 38 71 F6
D5 C4 D8 65 F2 56 0E F9 74 E9 3F 43 88 2D 54 4B 9C 8E 00 65
DE 88 7F D8 62 9C 37 F9 DC E8 D4 FD 64 CB 6E 88 2E 5F 80 16
F2 3C D2 2C 6C 08 9D E5 24 C0 84 55 83 02 81 2B 95 B3 87 96
E6 27 C9 57 4C 04 77 E2 82 D5 EC E8 E5 27 4E A1 A9 5A 47 A9
19 17 37 90 59 E5 E3 6E 5F 3E 91 EC AE 9B A0 32 1B A1 42 86
03 B7 C0 0B E0 46 93 CB 4B 03 92 6C F0 5B FF 1A 40 F7 F0 95
2B 17 B8 92 0A 35 D5 B2 8E 93 DF 32 69 71 DE 61 5B 3E B6 45
A7 A9 D2 FB 76 06 A5 C0 B1 01 C0 5D 87 DD 0B 79 C5 8D 79 63
2A 65 B4 EA 2F 3D 35 97 6E 4A CB FC 19 C6 36 7C 26 EC DC 29
4C 47 AB 87 B9 DD 85 42 DF A2 DE B6 1D 5D 1C 3D 3C 82 9C C1
B4 4B 30 88 D5 BE AF A9 BA 69 AB EA 61 A8 3C DB B5 D3 E1 F5
8F 2E 44 FD 75
Extension: Subject Alternative Name(2.5.29.17)
Critical: 0
Extension: Authority Key Identifier(2.5.29.35)
Critical: 0
Key Identifier: CE C3 1F 48 D2 F0 80 A9 65 AA D7 52 D0 E7 2C 8B CD 06 AE 3B
Extension: Authority Information Access(1.3.6.1.5.5.7.1.1)
Critical: 0
Method#1: Certificate Authority Issuers
URI: https://vcsa.lkpvm.com/afd/vecs/ca
Fingerprints :
SHA-256 Fingerprint: C4 D7 C0 1B 45 13 6F 35 A1 11 7C 70 B7 D8 2F 0A 09 BF 04 59
58 EB D4 F0 B1 BD 08 4C B7 32 42 8C
SHA-1 Fingerprint: 58 41 AF AC B4 00 24 77 34 96 BE DE 5C 51 E0 F1 6A 6E FD B0
MD5 Fingerprint: 2F A7 F8 FA 5D 98 6A 1F B6 9F E2 9A 88 3E E6 D9
PEM certificate :
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

##

10863 - SSL Certificate Information
-
Synopsis
This plugin displays the SSL certificate.
Description
This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2008/05/19, Modified: 2021/02/03
Plugin Output

## tcp/8182

Subject Name:
Country: US
State/Province: California
Locality: Palo Alto
Organization: VMware
Organization Unit: VMware Engineering
Common Name: 172.17.100.236
Email Address: vmca@vmware.com
Issuer Name:
Common Name: CA
Domain Component: vsphere
Domain Component: local
Country: US
State/Province: California
Organization: vcsa.lkpvm.com
Organization Unit: VMware Engineering
Serial Number: 00 E3 FD D3 28 5A A7 24 61
Version: 3
Signature Algorithm: SHA-256 With RSA Encryption
Not Valid Before: Jan 26 02:46:56 2025 GMT
Not Valid After: Jan 26 02:46:56 2030 GMT
Public Key Info:
Algorithm: RSA Encryption
Key Length: 2048 bits
Public Key: 00 BD C6 85 E7 1F E1 52 B4 47 6C D0 3E 40 A4 B9 8C 88 2B 23
15 94 53 30 25 3A 29 71 E3 2A 7F 3F FB 42 5E 69 B0 0B DD D9
1C AC B5 9A 00 24 01 AA A6 81 CA CF 49 16 6E D4 76 A5 E9 84
86 F6 A1 3A 38 93 73 27 9D 38 80 7B 40 A8 60 0D DC 63 4D 50
8C DB 88 92 BD 87 3F 26 D2 B7 FE C6 A8 C1 4D 35 2B CE BB 31
BA 92 F9 DF 64 FC F0 F0 8D 96 9E 2D 11 5E B9 A6 94 61 4B 35
B1 4F A6 A1 80 8C D9 13 A8 F6 5E 9F BE 58 31 E2 69 83 05 17
F5 5F F0 EA 85 AE 35 89 11 4F 24 4F DD FA 36 05 96 49 13 47
CF 2F 34 E1 A2 F7 4B 4E AC 36 CE 96 7B F2 7E 66 27 E1 97 B6
81 8F 69 DB D8 40 93 DD 7E E7 B5 E7 9A 7D DE BD 9B 4F A3 9B
D3 B9 D6 DC A9 4E FA 87 F6 58 C6 26 35 67 62 64 F9 84 08 B7
F9 77 55 48 6C 34 74 25 B2 B5 62 D1 92 E7 A9 8B 9E 82 0E BA
7C DE 3E 57 EF 0D F2 F3 0B BA 74 8E 78 87 14 1C 83
Exponent: 01 00 01
Signature Length: 384 bytes / 3072 bits
Signature: 00 D4 00 40 39 B0 77 EA DC 79 7E EF F4 71 55 9A 9B 7E 99 30
5B 2B 16 03 47 B2 CB 1B C4 61 9B 73 C2 76 35 F8 D9 C9 61 B4
D3 9C 8B 06 48 D7 08 10 DE 75 45 3B 2F C1 B3 BA 00 0A 5B 41
4D 26 C0 47 99 F9 56 B1 56 E3 EE FB E6 14 3C B3 FD 7B A3 D4
7C 5F 8C DF F4 B7 0F C9 C5 C1 A1 70 A1 F9 6E 59 63 71 1E C6
CC 18 E5 06 C8 02 FA B9 70 F4 BB 5B 4D BB 6A C4 F3 AD 1D F5
42 97 85 0A BB F4 52 D3 99 7E 66 6D 4B 4D 50 4B 98 7D A7 19
71 AA E9 E0 89 F6 2B 7A A2 94 70 E3 A4 1A CE EA 8D 38 71 F6
D5 C4 D8 65 F2 56 0E F9 74 E9 3F 43 88 2D 54 4B 9C 8E 00 65
DE 88 7F D8 62 9C 37 F9 DC E8 D4 FD 64 CB 6E 88 2E 5F 80 16
F2 3C D2 2C 6C 08 9D E5 24 C0 84 55 83 02 81 2B 95 B3 87 96
E6 27 C9 57 4C 04 77 E2 82 D5 EC E8 E5 27 4E A1 A9 5A 47 A9
19 17 37 90 59 E5 E3 6E 5F 3E 91 EC AE 9B A0 32 1B A1 42 86
03 B7 C0 0B E0 46 93 CB 4B 03 92 6C F0 5B FF 1A 40 F7 F0 95
2B 17 B8 92 0A 35 D5 B2 8E 93 DF 32 69 71 DE 61 5B 3E B6 45
A7 A9 D2 FB 76 06 A5 C0 B1 01 C0 5D 87 DD 0B 79 C5 8D 79 63
2A 65 B4 EA 2F 3D 35 97 6E 4A CB FC 19 C6 36 7C 26 EC DC 29
4C 47 AB 87 B9 DD 85 42 DF A2 DE B6 1D 5D 1C 3D 3C 82 9C C1
B4 4B 30 88 D5 BE AF A9 BA 69 AB EA 61 A8 3C DB B5 D3 E1 F5
8F 2E 44 FD 75
Extension: Subject Alternative Name(2.5.29.17)
Critical: 0
Extension: Authority Key Identifier(2.5.29.35)
Critical: 0
Key Identifier: CE C3 1F 48 D2 F0 80 A9 65 AA D7 52 D0 E7 2C 8B CD 06 AE 3B
Extension: Authority Information Access(1.3.6.1.5.5.7.1.1)
Critical: 0
Method#1: Certificate Authority Issuers
URI: https://vcsa.lkpvm.com/afd/vecs/ca
Fingerprints :
SHA-256 Fingerprint: C4 D7 C0 1B 45 13 6F 35 A1 11 7C 70 B7 D8 2F 0A 09 BF 04 59
58 EB D4 F0 B1 BD 08 4C B7 32 42 8C
SHA-1 Fingerprint: 58 41 AF AC B4 00 24 77 34 96 BE DE 5C 51 E0 F1 6A 6E FD B0
MD5 Fingerprint: 2F A7 F8 FA 5D 98 6A 1F B6 9F E2 9A 88 3E E6 D9
PEM certificate :
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

##

10863 - SSL Certificate Information
-
Synopsis
This plugin displays the SSL certificate.
Description
This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2008/05/19, Modified: 2021/02/03
Plugin Output

## tcp/9080/www

Subject Name:
Country: US
State/Province: California
Locality: Palo Alto
Organization: VMware
Organization Unit: VMware Engineering
Common Name: 172.17.100.236
Email Address: vmca@vmware.com
Issuer Name:
Common Name: CA
Domain Component: vsphere
Domain Component: local
Country: US
State/Province: California
Organization: vcsa.lkpvm.com
Organization Unit: VMware Engineering
Serial Number: 00 E3 FD D3 28 5A A7 24 61
Version: 3
Signature Algorithm: SHA-256 With RSA Encryption
Not Valid Before: Jan 26 02:46:56 2025 GMT
Not Valid After: Jan 26 02:46:56 2030 GMT
Public Key Info:
Algorithm: RSA Encryption
Key Length: 2048 bits
Public Key: 00 BD C6 85 E7 1F E1 52 B4 47 6C D0 3E 40 A4 B9 8C 88 2B 23
15 94 53 30 25 3A 29 71 E3 2A 7F 3F FB 42 5E 69 B0 0B DD D9
1C AC B5 9A 00 24 01 AA A6 81 CA CF 49 16 6E D4 76 A5 E9 84
86 F6 A1 3A 38 93 73 27 9D 38 80 7B 40 A8 60 0D DC 63 4D 50
8C DB 88 92 BD 87 3F 26 D2 B7 FE C6 A8 C1 4D 35 2B CE BB 31
BA 92 F9 DF 64 FC F0 F0 8D 96 9E 2D 11 5E B9 A6 94 61 4B 35
B1 4F A6 A1 80 8C D9 13 A8 F6 5E 9F BE 58 31 E2 69 83 05 17
F5 5F F0 EA 85 AE 35 89 11 4F 24 4F DD FA 36 05 96 49 13 47
CF 2F 34 E1 A2 F7 4B 4E AC 36 CE 96 7B F2 7E 66 27 E1 97 B6
81 8F 69 DB D8 40 93 DD 7E E7 B5 E7 9A 7D DE BD 9B 4F A3 9B
D3 B9 D6 DC A9 4E FA 87 F6 58 C6 26 35 67 62 64 F9 84 08 B7
F9 77 55 48 6C 34 74 25 B2 B5 62 D1 92 E7 A9 8B 9E 82 0E BA
7C DE 3E 57 EF 0D F2 F3 0B BA 74 8E 78 87 14 1C 83
Exponent: 01 00 01
Signature Length: 384 bytes / 3072 bits
Signature: 00 D4 00 40 39 B0 77 EA DC 79 7E EF F4 71 55 9A 9B 7E 99 30
5B 2B 16 03 47 B2 CB 1B C4 61 9B 73 C2 76 35 F8 D9 C9 61 B4
D3 9C 8B 06 48 D7 08 10 DE 75 45 3B 2F C1 B3 BA 00 0A 5B 41
4D 26 C0 47 99 F9 56 B1 56 E3 EE FB E6 14 3C B3 FD 7B A3 D4
7C 5F 8C DF F4 B7 0F C9 C5 C1 A1 70 A1 F9 6E 59 63 71 1E C6
CC 18 E5 06 C8 02 FA B9 70 F4 BB 5B 4D BB 6A C4 F3 AD 1D F5
42 97 85 0A BB F4 52 D3 99 7E 66 6D 4B 4D 50 4B 98 7D A7 19
71 AA E9 E0 89 F6 2B 7A A2 94 70 E3 A4 1A CE EA 8D 38 71 F6
D5 C4 D8 65 F2 56 0E F9 74 E9 3F 43 88 2D 54 4B 9C 8E 00 65
DE 88 7F D8 62 9C 37 F9 DC E8 D4 FD 64 CB 6E 88 2E 5F 80 16
F2 3C D2 2C 6C 08 9D E5 24 C0 84 55 83 02 81 2B 95 B3 87 96
E6 27 C9 57 4C 04 77 E2 82 D5 EC E8 E5 27 4E A1 A9 5A 47 A9
19 17 37 90 59 E5 E3 6E 5F 3E 91 EC AE 9B A0 32 1B A1 42 86
03 B7 C0 0B E0 46 93 CB 4B 03 92 6C F0 5B FF 1A 40 F7 F0 95
2B 17 B8 92 0A 35 D5 B2 8E 93 DF 32 69 71 DE 61 5B 3E B6 45
A7 A9 D2 FB 76 06 A5 C0 B1 01 C0 5D 87 DD 0B 79 C5 8D 79 63
2A 65 B4 EA 2F 3D 35 97 6E 4A CB FC 19 C6 36 7C 26 EC DC 29
4C 47 AB 87 B9 DD 85 42 DF A2 DE B6 1D 5D 1C 3D 3C 82 9C C1
B4 4B 30 88 D5 BE AF A9 BA 69 AB EA 61 A8 3C DB B5 D3 E1 F5
8F 2E 44 FD 75
Extension: Subject Alternative Name(2.5.29.17)
Critical: 0
Extension: Authority Key Identifier(2.5.29.35)
Critical: 0
Key Identifier: CE C3 1F 48 D2 F0 80 A9 65 AA D7 52 D0 E7 2C 8B CD 06 AE 3B
Extension: Authority Information Access(1.3.6.1.5.5.7.1.1)
Critical: 0
Method#1: Certificate Authority Issuers
URI: https://vcsa.lkpvm.com/afd/vecs/ca
Fingerprints :
SHA-256 Fingerprint: C4 D7 C0 1B 45 13 6F 35 A1 11 7C 70 B7 D8 2F 0A 09 BF 04 59
58 EB D4 F0 B1 BD 08 4C B7 32 42 8C
SHA-1 Fingerprint: 58 41 AF AC B4 00 24 77 34 96 BE DE 5C 51 E0 F1 6A 6E FD B0
MD5 Fingerprint: 2F A7 F8 FA 5D 98 6A 1F B6 9F E2 9A 88 3E E6 D9
PEM certificate :
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

##

70544 - SSL Cipher Block Chaining Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Cipher Block Chaining ciphers, which combine previous blocks with subsequent ones.
Description
The remote host supports the use of SSL ciphers that operate in Cipher Block Chaining (CBC) mode. These cipher suites offer additional security over Electronic Codebook (ECB) mode, but have the potential to leak information if used improperly.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
http://www.nessus.org/u?cc4a822a
https://www.openssl.org/~bodo/tls-cbc.txt

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/22, Modified: 2021/02/03
Plugin Output

## tcp/443/www

Here is the list of SSL CBC ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

70544 - SSL Cipher Block Chaining Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Cipher Block Chaining ciphers, which combine previous blocks with subsequent ones.
Description
The remote host supports the use of SSL ciphers that operate in Cipher Block Chaining (CBC) mode. These cipher suites offer additional security over Electronic Codebook (ECB) mode, but have the potential to leak information if used improperly.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
http://www.nessus.org/u?cc4a822a
https://www.openssl.org/~bodo/tls-cbc.txt

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/22, Modified: 2021/02/03
Plugin Output

## tcp/8182

Here is the list of SSL CBC ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

70544 - SSL Cipher Block Chaining Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Cipher Block Chaining ciphers, which combine previous blocks with subsequent ones.
Description
The remote host supports the use of SSL ciphers that operate in Cipher Block Chaining (CBC) mode. These cipher suites offer additional security over Electronic Codebook (ECB) mode, but have the potential to leak information if used improperly.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
http://www.nessus.org/u?cc4a822a
https://www.openssl.org/~bodo/tls-cbc.txt

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2013/10/22, Modified: 2021/02/03
Plugin Output

## tcp/9080/www

Here is the list of SSL CBC ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

21643 - SSL Cipher Suites Supported
-
Synopsis
The remote service encrypts communications using SSL.
Description
This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.
See Also

https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
http://www.nessus.org/u?e17ffced

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2006/06/05, Modified: 2024/09/11
Plugin Output

## tcp/443/www

Here is the list of SSL ciphers supported by the remote server :
Each group is reported per SSL Version.
SSL Version : TLSv12
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

21643 - SSL Cipher Suites Supported
-
Synopsis
The remote service encrypts communications using SSL.
Description
This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.
See Also

https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
http://www.nessus.org/u?e17ffced

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2006/06/05, Modified: 2024/09/11
Plugin Output

## tcp/8182

Here is the list of SSL ciphers supported by the remote server :
Each group is reported per SSL Version.
SSL Version : TLSv13
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
TLS_AES_256_GCM_SHA384 0x13, 0x02 - - AES-GCM(256) SHA384
SSL Version : TLSv12
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

21643 - SSL Cipher Suites Supported
-
Synopsis
The remote service encrypts communications using SSL.
Description
This plugin detects which SSL ciphers are supported by the remote service for encrypting communications.
See Also

https://www.openssl.org/docs/man1.0.2/man1/ciphers.html
http://www.nessus.org/u?e17ffced

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2006/06/05, Modified: 2024/09/11
Plugin Output

## tcp/9080/www

Here is the list of SSL ciphers supported by the remote server :
Each group is reported per SSL Version.
SSL Version : TLSv13
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
TLS_AES_256_GCM_SHA384 0x13, 0x02 - - AES-GCM(256) SHA384
SSL Version : TLSv12
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

57041 - SSL Perfect Forward Secrecy Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Perfect Forward Secrecy ciphers, which maintain confidentiality even if the key is stolen.
Description
The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy (PFS) encryption. These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
https://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange
https://en.wikipedia.org/wiki/Perfect_forward_secrecy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/07, Modified: 2021/03/09
Plugin Output

## tcp/443/www

Here is the list of SSL PFS ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

57041 - SSL Perfect Forward Secrecy Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Perfect Forward Secrecy ciphers, which maintain confidentiality even if the key is stolen.
Description
The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy (PFS) encryption. These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
https://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange
https://en.wikipedia.org/wiki/Perfect_forward_secrecy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/07, Modified: 2021/03/09
Plugin Output

## tcp/8182

Here is the list of SSL PFS ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

57041 - SSL Perfect Forward Secrecy Cipher Suites Supported
-
Synopsis
The remote service supports the use of SSL Perfect Forward Secrecy ciphers, which maintain confidentiality even if the key is stolen.
Description
The remote host supports the use of SSL ciphers that offer Perfect Forward Secrecy (PFS) encryption. These cipher suites ensure that recorded SSL traffic cannot be broken at a future date if the server's private key is compromised.
See Also

https://www.openssl.org/docs/manmaster/man1/ciphers.html
https://en.wikipedia.org/wiki/Diffie-Hellman_key_exchange
https://en.wikipedia.org/wiki/Perfect_forward_secrecy

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2011/12/07, Modified: 2021/03/09
Plugin Output

## tcp/9080/www

Here is the list of SSL PFS ciphers supported by the remote server :
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA256 0xC0, 0x2F ECDHE RSA AES-GCM(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x30 ECDHE RSA AES-GCM(256) SHA384
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

94761 - SSL Root Certification Authority Certificate Information
-
Synopsis
A root Certification Authority certificate was found at the top of the certificate chain.
Description
The remote service uses an SSL certificate chain that contains a self-signed root Certification Authority certificate at the top of the chain.
See Also

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778623(v=ws.10)

Solution
Ensure that use of this root Certification Authority certificate complies with your organization's acceptable use and security policies.
Risk Factor
None
Plugin Information
Published: 2016/11/14, Modified: 2018/11/15
Plugin Output

## tcp/8182

The following root Certification Authority certificate was found :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Issuer : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Valid From : Jan 24 01:02:01 2025 GMT
|-Valid To : Jan 22 01:02:01 2035 GMT
|-Signature Algorithm : SHA-256 With RSA Encryption

##

94761 - SSL Root Certification Authority Certificate Information
-
Synopsis
A root Certification Authority certificate was found at the top of the certificate chain.
Description
The remote service uses an SSL certificate chain that contains a self-signed root Certification Authority certificate at the top of the chain.
See Also

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778623(v=ws.10)

Solution
Ensure that use of this root Certification Authority certificate complies with your organization's acceptable use and security policies.
Risk Factor
None
Plugin Information
Published: 2016/11/14, Modified: 2018/11/15
Plugin Output

## tcp/9080/www

The following root Certification Authority certificate was found :
|-Subject : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Issuer : CN=CA/DC=vsphere/DC=local/C=US/ST=California/O=vcsa.lkpvm.com/OU=VMware Engineering
|-Valid From : Jan 24 01:02:01 2025 GMT
|-Valid To : Jan 22 01:02:01 2035 GMT
|-Signature Algorithm : SHA-256 With RSA Encryption

##

156899 - SSL/TLS Recommended Cipher Suites
-
Synopsis
The remote host advertises discouraged SSL/TLS ciphers.
Description
The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:
TLSv1.3:
- 0x13,0x01 TLS13_AES_128_GCM_SHA256
- 0x13,0x02 TLS13_AES_256_GCM_SHA384
- 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256
TLSv1.2:
- 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
- 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
- 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
- 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
- 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
- 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305
This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.
See Also

https://wiki.mozilla.org/Security/Server_Side_TLS
https://ssl-config.mozilla.org/

Solution
Only enable support for recommened cipher suites.
Risk Factor
None
Plugin Information
Published: 2022/01/20, Modified: 2024/02/12
Plugin Output

## tcp/443/www

The remote host has listening SSL/TLS ports which advertise the discouraged cipher suites outlined below:
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

156899 - SSL/TLS Recommended Cipher Suites
-
Synopsis
The remote host advertises discouraged SSL/TLS ciphers.
Description
The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:
TLSv1.3:
- 0x13,0x01 TLS13_AES_128_GCM_SHA256
- 0x13,0x02 TLS13_AES_256_GCM_SHA384
- 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256
TLSv1.2:
- 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
- 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
- 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
- 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
- 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
- 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305
This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.
See Also

https://wiki.mozilla.org/Security/Server_Side_TLS
https://ssl-config.mozilla.org/

Solution
Only enable support for recommened cipher suites.
Risk Factor
None
Plugin Information
Published: 2022/01/20, Modified: 2024/02/12
Plugin Output

## tcp/8182

The remote host has listening SSL/TLS ports which advertise the discouraged cipher suites outlined below:
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

156899 - SSL/TLS Recommended Cipher Suites
-
Synopsis
The remote host advertises discouraged SSL/TLS ciphers.
Description
The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites:
TLSv1.3:
- 0x13,0x01 TLS13_AES_128_GCM_SHA256
- 0x13,0x02 TLS13_AES_256_GCM_SHA384
- 0x13,0x03 TLS13_CHACHA20_POLY1305_SHA256
TLSv1.2:
- 0xC0,0x2B ECDHE-ECDSA-AES128-GCM-SHA256
- 0xC0,0x2F ECDHE-RSA-AES128-GCM-SHA256
- 0xC0,0x2C ECDHE-ECDSA-AES256-GCM-SHA384
- 0xC0,0x30 ECDHE-RSA-AES256-GCM-SHA384
- 0xCC,0xA9 ECDHE-ECDSA-CHACHA20-POLY1305
- 0xCC,0xA8 ECDHE-RSA-CHACHA20-POLY1305
This is the recommended configuration for the vast majority of services, as it is highly secure and compatible with nearly every client released in the last five (or more) years.
See Also

https://wiki.mozilla.org/Security/Server_Side_TLS
https://ssl-config.mozilla.org/

Solution
Only enable support for recommened cipher suites.
Risk Factor
None
Plugin Information
Published: 2022/01/20, Modified: 2024/02/12
Plugin Output

## tcp/9080/www

The remote host has listening SSL/TLS ports which advertise the discouraged cipher suites outlined below:
High Strength Ciphers (>= 112-bit key)
Name Code KEX Auth Encryption MAC
---------------------- ---------- --- ---- --------------------- ---
ECDHE-RSA-AES128-SHA 0xC0, 0x13 ECDHE RSA AES-CBC(128) SHA1
ECDHE-RSA-AES256-SHA 0xC0, 0x14 ECDHE RSA AES-CBC(256) SHA1
ECDHE-RSA-AES128-SHA256 0xC0, 0x27 ECDHE RSA AES-CBC(128) SHA256
ECDHE-RSA-AES256-SHA384 0xC0, 0x28 ECDHE RSA AES-CBC(256) SHA384
The fields above are :
{Tenable ciphername}
{Cipher ID code}
Kex={key exchange}
Auth={authentication}
Encrypt={symmetric encryption method}
MAC={message authentication code}
{export flag}

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/22/ssh

An SSH server is running on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/80/www

A web server is running on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/443/www

A TLSv1.2 server answered on this port.

## tcp/443/www

A web server is running on this port through TLSv1.2.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/902/vmware_auth

A VMware authentication daemon is running on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/8182

A TLSv1.3 server answered on this port.

##

22964 - Service Detection
-
Synopsis
The remote service could be identified.
Description
Nessus was able to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/08/19, Modified: 2025/12/08
Plugin Output

## tcp/9080/www

A TLSv1.3 server answered on this port.

## tcp/9080/www

A web server is running on this port through TLSv1.3.

##

278501 - Smartbedded Meteobridge Web Detection
-
Synopsis
The web UI for Smartbedded Meteobridge was detected on the remote host.
Description
Smartbedded Meteobridge, a dedicated weather monitoring application, is running on the remote host.
Note: Basic HTTP Authentication credentials are required to obtain the version.
See Also

https://www.meteobridge.com/wiki/index.php?title=Meteobridge_VM
http://www.nessus.org/u?5ceb65be

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/12, Modified: 2025/12/15
Plugin Output

## tcp/80/www

URL : http://172.17.100.236/cgi-bin/meteobridge
Version : unknown
Authenticated : False

##

278501 - Smartbedded Meteobridge Web Detection
-
Synopsis
The web UI for Smartbedded Meteobridge was detected on the remote host.
Description
Smartbedded Meteobridge, a dedicated weather monitoring application, is running on the remote host.
Note: Basic HTTP Authentication credentials are required to obtain the version.
See Also

https://www.meteobridge.com/wiki/index.php?title=Meteobridge_VM
http://www.nessus.org/u?5ceb65be

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/12, Modified: 2025/12/15
Plugin Output

## tcp/443/www

URL : https://172.17.100.236/cgi-bin/meteobridge
Version : unknown
Authenticated : False

##

278501 - Smartbedded Meteobridge Web Detection
-
Synopsis
The web UI for Smartbedded Meteobridge was detected on the remote host.
Description
Smartbedded Meteobridge, a dedicated weather monitoring application, is running on the remote host.
Note: Basic HTTP Authentication credentials are required to obtain the version.
See Also

https://www.meteobridge.com/wiki/index.php?title=Meteobridge_VM
http://www.nessus.org/u?5ceb65be

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/12, Modified: 2025/12/15
Plugin Output

## tcp/9080/www

URL : https://172.17.100.236:9080/cgi-bin/meteobridge
Version : unknown
Authenticated : False

##

22869 - Software Enumeration (SSH)
-
Synopsis
It was possible to enumerate installed software on the remote host via SSH.
Description
Nessus was able to list the software installed on the remote host by calling the appropriate command (e.g., 'rpm -qa' on RPM-based Linux distributions, qpkg, dpkg, etc.).
Solution
Remove any software that is not in compliance with your organization's acceptable use and security policies.
Risk Factor
None
References

XREF | IAVT:0001-T-0502

Plugin Information
Published: 2006/10/15, Modified: 2025/03/26
Plugin Output

## tcp/0

Here is the list of packages installed on the remote VMware ESXi / ESX system :
ESXi Version : VMware ESXi 8.0.2 build-23825572
Name Version Vendor Acceptance Level Install Date Platforms
25220 - TCP/IP Timestamps Supported
-
Synopsis
The remote service implements TCP timestamps.
Description
The remote host implements TCP timestamps, as defined by RFC1323. A side effect of this feature is that the uptime of the remote host can sometimes be computed.
See Also

http://www.ietf.org/rfc/rfc1323.txt

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2007/05/16, Modified: 2023/10/17
Plugin Output

## tcp/0

##

84821 - TLS ALPN Supported Protocol Enumeration
-
Synopsis
The remote host supports the TLS ALPN extension.
Description
The remote host supports the TLS ALPN extension. This plugin enumerates the protocols the extension supports.
See Also

https://tools.ietf.org/html/rfc7301

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2015/07/17, Modified: 2024/09/11
Plugin Output

## tcp/443/www

http/1.1
h2

##

277654 - TLS Supported Groups
-
Synopsis
The remote service negotiates TLS supported curve groups.
Description
This plugin detects which TLS supported groups entries are supported by the remote service.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/8182

These are the TLS supported groups offered by the remote server :
TLS supported groups :
Name Code
--------------------------
secp256r1 0x0017
secp384r1 0x0018
secp521r1 0x0019

##

277654 - TLS Supported Groups
-
Synopsis
The remote service negotiates TLS supported curve groups.
Description
This plugin detects which TLS supported groups entries are supported by the remote service.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2025/12/08, Modified: 2025/12/10
Plugin Output

## tcp/9080/www

These are the TLS supported groups offered by the remote server :
TLS supported groups :
Name Code
--------------------------
secp256r1 0x0017
secp384r1 0x0018
secp521r1 0x0019

##

136318 - TLS Version 1.2 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.2.
See Also

https://tools.ietf.org/html/rfc5246

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/05/04, Modified: 2020/05/04
Plugin Output

## tcp/443/www

TLSv1.2 is enabled and the server supports at least one cipher.

##

136318 - TLS Version 1.2 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.2.
See Also

https://tools.ietf.org/html/rfc5246

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/05/04, Modified: 2020/05/04
Plugin Output

## tcp/8182

TLSv1.2 is enabled and the server supports at least one cipher.

##

136318 - TLS Version 1.2 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.2.
See Also

https://tools.ietf.org/html/rfc5246

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/05/04, Modified: 2020/05/04
Plugin Output

## tcp/9080/www

TLSv1.2 is enabled and the server supports at least one cipher.

##

138330 - TLS Version 1.3 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.3.
See Also

https://tools.ietf.org/html/rfc8446

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/07/09, Modified: 2023/12/13
Plugin Output

## tcp/8182

TLSv1.3 is enabled and the server supports at least one cipher.

##

138330 - TLS Version 1.3 Protocol Detection
-
Synopsis
The remote service encrypts traffic using a version of TLS.
Description
The remote service accepts connections encrypted using TLS 1.3.
See Also

https://tools.ietf.org/html/rfc8446

Solution
N/A
Risk Factor
None
Plugin Information
Published: 2020/07/09, Modified: 2023/12/13
Plugin Output

## tcp/9080/www

TLSv1.3 is enabled and the server supports at least one cipher.

##

110095 - Target Credential Issues by Authentication Protocol - No Issues Found
-
Synopsis
Nessus was able to log in to the remote host using the provided credentials. No issues were reported with access, privilege, or intermittent failure.
Description
Valid credentials were provided for an authentication protocol on the remote target and Nessus did not log any subsequent errors or failures for the authentication protocol.
When possible, Nessus tracks errors or failures related to otherwise valid credentials in order to highlight issues that may result in incomplete scan results or limited scan coverage. The types of issues that are tracked include errors that indicate that the account used for scanning did not have sufficient permissions for a particular check, intermittent protocol failures which are unexpected after the protocol has been negotiated successfully earlier in the scan, and intermittent authentication failures which are unexpected after a credential set has been accepted as valid earlier in the scan. This plugin reports when none of the above issues have been logged during the course of the scan for at least one authenticated protocol. See plugin output for details, including protocol, port, and account.
Please note the following :
- This plugin reports per protocol, so it is possible for issues to be encountered for one protocol and not another.
For example, authentication to the SSH service on the remote target may have consistently succeeded with no privilege errors encountered, while connections to the SMB service on the remote target may have failed intermittently.
- Resolving logged issues for all available authentication protocols may improve scan coverage, but the value of resolving each issue for a particular protocol may vary from target to target depending upon what data (if any) is gathered from the target via that protocol and what particular check failed. For example, consistently successful checks via SSH are more critical for Linux targets than for Windows targets, and likewise consistently successful checks via SMB are more critical for Windows targets than for Linux targets.
Solution
n/a
Risk Factor
None
References

XREF | IAVB:0001-B-0520

Plugin Information
Published: 2018/05/24, Modified: 2025/08/28
Plugin Output

## tcp/22/ssh

Nessus was able to log into the remote host with no privilege or access
problems via the following :
User: 'root'
Port: 22
Proto: SSH
Method: keyboard-interactive
141118 - Target Credential Status by Authentication Protocol - Valid Credentials Provided
-
Synopsis
Valid credentials were provided for an available authentication protocol.
Description
Nessus was able to determine that valid credentials were provided for an authentication protocol available on the remote target because it was able to successfully authenticate directly to the remote target using that authentication protocol at least once. Authentication was successful because the authentication protocol service was available remotely, the service was able to be identified, the authentication protocol was able to be negotiated successfully, and a set of credentials provided in the scan policy for that authentication protocol was accepted by the remote service. See plugin output for details, including protocol, port, and account.
Please note the following :
- This plugin reports per protocol, so it is possible for valid credentials to be provided for one protocol and not another. For example, authentication may succeed via SSH but fail via SMB, while no credentials were provided for an available SNMP service.
- Providing valid credentials for all available authentication protocols may improve scan coverage, but the value of successful authentication for a given protocol may vary from target to target depending upon what data (if any) is gathered from the target via that protocol. For example, successful authentication via SSH is more valuable for Linux targets than for Windows targets, and likewise successful authentication via SMB is more valuable for Windows targets than for Linux targets.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2020/10/15, Modified: 2024/03/25
Plugin Output

## tcp/22/ssh

Nessus was able to log in to the remote host via the following :
User: 'root'
Port: 22
Proto: SSH
Method: keyboard-interactive

##

10287 - Traceroute Information
-
Synopsis
It was possible to obtain traceroute information.
Description
Makes a traceroute to the remote host.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 1999/11/27, Modified: 2023/12/04
Plugin Output

## udp/0

For your information, here is the traceroute from 172.17.100.38 to 172.17.100.236 :
172.17.100.38
172.17.100.236
Hop Count: 1

##

186361 - VMWare Tools or Open VM Tools Installed (Linux)
-
Synopsis
VMWare Tools or Open VM Tools were detected on the remote Linux host.
Description
VMWare Tools or Open VM Tools were detected on the remote Linux host.
See Also

https://kb.vmware.com/s/article/340
http://www.nessus.org/u?c0628155

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2023/11/28, Modified: 2025/12/18
Plugin Output

## tcp/0

Path : /usr/sbin/vmtoolsd
Version : 12.3.5

##

20301 - VMware ESX/GSX Server Authentication Daemon Detection
-
Synopsis
The authentication daemon for VMware ESX or GSX was detected on the remote host.
Description
The authentication daemon for VMware ESX or GSX was detected on the remote host.
See Also

https://www.vmware.com/

Solution
n/a
Risk Factor
None
Plugin Information
Published: 2005/12/14, Modified: 2025/06/17
Plugin Output

## tcp/902/vmware_auth

Service : vmware_auth
Version : unknown

##

57396 - VMware vSphere Detect
-
Synopsis
The web client for VMware vSphere or ESXi was detected on the remote host.
Description
The web client for VMware vSphere or ESXi was detected on the remote host.
Please see https://docs.tenable.com/vulnerability-management/Content/Scans/VMWareScanConfiguration.htm for more information on how to configure the scan.
See Also

https://www.vmware.com/products/cloud-infrastructure/vsphere

Solution
n/a
Risk Factor
None
References

XREF | IAVT:0001-T-0743

Plugin Information
Published: 2011/12/23, Modified: 2025/12/15
Plugin Output

## tcp/443/www

Version : VMware ESXi 8.0.2 build-23825572
API Version : HostAgent
Uses HTTPS : yes

##

10386 - Web Server No 404 Error Code Check
-
Synopsis
The remote web server does not return 404 error codes.
Description
The remote web server is configured such that it does not return '404 Not Found' error codes when a nonexistent file is requested, perhaps returning instead a site map, search page or authentication page.
Nessus has enabled some counter measures for this. However, they might be insufficient. If a great number of security holes are produced for this port, they might not all be accurate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2000/04/28, Modified: 2022/06/17
Plugin Output

## tcp/80/www

CGI scanning will be disabled for this host because the host responds
to requests for non-existent URLs with HTTP code 301
rather than 404. The requested URL was :
http://172.17.100.236/j8MpS1uoCPve.html

##

10386 - Web Server No 404 Error Code Check
-
Synopsis
The remote web server does not return 404 error codes.
Description
The remote web server is configured such that it does not return '404 Not Found' error codes when a nonexistent file is requested, perhaps returning instead a site map, search page or authentication page.
Nessus has enabled some counter measures for this. However, they might be insufficient. If a great number of security holes are produced for this port, they might not all be accurate.
Solution
n/a
Risk Factor
None
Plugin Information
Published: 2000/04/28, Modified: 2022/06/17
Plugin Output

## tcp/443/www

The following string will be used :
TYPE="password"

###### Compliance 'FAILED'

###### Compliance 'SKIPPED'

###### Compliance 'PASSED'

###### Compliance 'INFO', 'WARNING', 'ERROR'

###### Remediations

Suggested Remediations
Taking the following actions across 1 hosts would resolve 31% of the vulnerabilities on the network.

| Action to take |  | Vulns | Hosts
| OpenSSH < 10.1 / 10.1p1 Multiple Vulnerabilities: Upgrade to OpenSSH version 10.1/10.1p1 or later. |  | 6 | 1

© 2026 Tenable™, Inc. All rights reserved.